Microsoft AZ-500 Practice Test 79
Question 780
Security analysts need to correlate suspicious SQL access with Azure Monitor or storage audit records. A review identifies this consequence: Missing or misrouted audit data prevents reconstruction of important database activity. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to disable auditing to keep sensitive query history out of storage without another control.
- The controlled remediation is to configure the audit destination and verify current events can be queried securely.
- The controlled remediation is to enable only TDE and assume it records every failed login event.
- The controlled remediation is to use a blob access tier to decide which SQL commands generate audit logs.
Explanation
Correct Answer
B:Test using these records: SQL audit setting, selected actions, diagnostic destination, sample event and retention. Azure SQL auditing records specified database operations to support accountability and incident investigation.
Incorrect Answers
A:Disable auditing to keep sensitive query history out of storage without another control. This would not reliably restore the intended security boundary. Missing or misrouted audit data prevents reconstruction of important database activity. The appropriate controlled recovery is: Configure the audit destination and verify current events can be queried securely.
C:Enable only TDE and assume it records every failed login event. This would not reliably restore the intended security boundary. Missing or misrouted audit data prevents reconstruction of important database activity. The appropriate controlled recovery is: Configure the audit destination and verify current events can be queried securely.
D:Use a blob access tier to decide which SQL commands generate audit logs. This would not reliably restore the intended security boundary. Missing or misrouted audit data prevents reconstruction of important database activity. The appropriate controlled recovery is: Configure the audit destination and verify current events can be queried securely.
Question 781
An Azure landing zone must stop creation of public IPs but a team assigns only an Audit policy that records violations. Which operator action best meets this technical requirement?
- Assume Audit automatically prevents any matching ARM deployment.
- Use a management group Reader grant to deny resource creation by all other principals.
- Treat Deny as a universal automatic cleanup of all existing noncompliant resources.
- Select and assign a policy effect appropriate to prevention or assessment and test new and existing resources.
Explanation
Correct Answer
D:Confirm the change against these records: Policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state. This directly addresses Azure Policy audit versus deny effects.
Incorrect Answers
A:Using only Audit does not block new deployments and Deny does not automatically delete existing resources.
B:That option would use a management group Reader grant to deny resource creation by all other principals, but it addresses a different concern. Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources.
C:Using only Audit does not block new deployments and Deny does not automatically delete existing resources. The intended action is: Select and assign a policy effect appropriate to prevention or assessment and test new and existing resources.
Question 782
An Azure landing zone must stop creation of public IPs but a team assigns only an Audit policy that records violations. Which collection of observations most directly tests the suspected cause?
- A connected agent indicator without a matching data collection rule or event record.
- An incident title without its actual source telemetry and detection results.
- A planned Azure Policy assignment without evaluated compliance or deployment evidence.
- Policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state.
Explanation
Correct Answer
D:These records test the actual Azure Policy audit versus deny effects behavior rather than an unrelated dashboard state. Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state.
C:On its own, that evidence does not prove the specified security control works. A planned Azure Policy assignment without evaluated compliance or deployment evidence.
Question 783
An Azure landing zone must stop creation of public IPs but a team assigns only an Audit policy that records violations. Which statement most accurately explains this scenario?
- Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources.
- Turning off an alert source is equivalent to remediating the underlying threat.
- Assigning a policy automatically remediates all existing resources under every effect.
- A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
Explanation
Correct Answer
A:Confirmation depends on Policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state. This principle supports the security response: Select and assign a policy effect appropriate to prevention or assessment and test new and existing resources.
Incorrect Answers
B:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Azure Policy audit versus deny effects. The relevant security behavior is: Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources. Check evidence such as policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state.
C:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Azure Policy audit versus deny effects. The relevant security behavior is: Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources. Check evidence such as policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state.
D:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Azure Policy audit versus deny effects. The relevant security behavior is: Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources. Check evidence such as policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state.
Question 784
An Azure landing zone must stop creation of public IPs but a team assigns only an Audit policy that records violations. Suppose the operator instead follows this unsafe shortcut: Assume Audit automatically prevents any matching ARM deployment. What is the principal technical consequence of the mistaken choice?
- Running a scoped compliance assessment automatically deletes protected resources.
- Maintaining the required incident log is itself the unauthorized API request.
- Using only Audit does not block new deployments and Deny does not automatically delete existing resources.
- A successful remediation test was the original reason the plan was disabled.
Explanation
Correct Answer
C:The suitable control is: Select and assign a policy effect appropriate to prevention or assessment and test new and existing resources. Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources.
Incorrect Answers
A:This does not explain the real Azure Policy audit versus deny effects weakness after the shortcut. The material failure is: Using only Audit does not block new deployments and Deny does not automatically delete existing resources.
B:This does not explain the real Azure Policy audit versus deny effects weakness after the shortcut. Inspect evidence such as policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state.
D:This does not explain the real Azure Policy audit versus deny effects weakness after the shortcut. In the given case, an Azure landing zone must stop creation of public IPs but a team assigns only an Audit policy that records violations.
Question 785
An Azure landing zone must stop creation of public IPs but a team assigns only an Audit policy that records violations. A review identifies this consequence: Using only Audit does not block new deployments and Deny does not automatically delete existing resources. Which recovery action restores the intended control and validates its effect?
- Deploy the intended preventive effect and address existing noncompliance through separately approved remediation.
- Use a management group Reader grant to deny resource creation by all other principals.
- Treat Deny as a universal automatic cleanup of all existing noncompliant resources.
- Assume Audit automatically prevents any matching ARM deployment.
Explanation
Correct Answer
A:Test using these records: Policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state. Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources.
Incorrect Answers
B:That option would use a management group Reader grant to deny resource creation by all other principals, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
C:That option would treat Deny as a universal automatic cleanup of all existing noncompliant resources, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
D:Assume Audit automatically prevents any matching ARM deployment. This would not reliably restore the intended security boundary. Using only Audit does not block new deployments and Deny does not automatically delete existing resources. The appropriate controlled recovery is: Deploy the intended preventive effect and address existing noncompliance through separately approved remediation.
Question 786
An operator expects an Azure Policy Deny assignment to remove already-deployed noncompliant storage accounts automatically. What is the most defensible Azure security action?
- For this Azure workload, the team should use a management group Reader grant to deny resource creation by all other principals.
- For this Azure workload, the team should treat Deny as a universal automatic cleanup of all existing noncompliant resources.
- For this Azure workload, the team should assume Audit automatically prevents any matching ARM deployment.
- For this Azure workload, the team should select and assign a policy effect appropriate to prevention or assessment and test new and existing resources.
Explanation
Correct Answer
D:Confirm the change against these records: Policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state. Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources.
Incorrect Answers
A:Use a management group Reader grant to deny resource creation by all other principals. The proposed change targets the wrong mechanism or lacks essential validation. Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources. Relevant evidence is policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state.
B:Using only Audit does not block new deployments and Deny does not automatically delete existing resources. Treat Deny as a universal automatic cleanup of all existing noncompliant resources.
C:Using only Audit does not block new deployments and Deny does not automatically delete existing resources.
Question 787
An operator expects an Azure Policy Deny assignment to remove already-deployed noncompliant storage accounts automatically. Which diagnostic record would most strongly confirm the result?
- In this security review, examine an inventory item list from a different subscription or connected cloud account.
- In this security review, examine policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state.
- In this security review, examine a connected agent indicator without a matching data collection rule or event record.
- In this security review, examine an incident title without its actual source telemetry and detection results.
Explanation
Correct Answer
B:These records test the actual Azure Policy audit versus deny effects behavior rather than an unrelated dashboard state. The intended action is: Select and assign a policy effect appropriate to prevention or assessment and test new and existing resources.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. An inventory item list from a different subscription or connected cloud account.
C:On its own, that evidence does not prove the specified security control works. A connected agent indicator without a matching data collection rule or event record.
D:On its own, that evidence does not prove the specified security control works. An incident title without its actual source telemetry and detection results.
Question 788
An operator expects an Azure Policy Deny assignment to remove already-deployed noncompliant storage accounts automatically. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that a subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
- The applicable security principle is that turning off an alert source is equivalent to remediating the underlying threat.
- The applicable security principle is that Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources.
- The applicable security principle is that a published security standard alone grants managed identities permission to change resources.
Explanation
Correct Answer
C:Confirmation depends on Policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state. Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources.
Incorrect Answers
A:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Azure Policy audit versus deny effects. The relevant security behavior is: Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources. Check evidence such as policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state.
B:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Azure Policy audit versus deny effects. The relevant security behavior is: Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources. Check evidence such as policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state.
D:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Azure Policy audit versus deny effects. The relevant security behavior is: Azure Policy Audit reports noncompliance while Deny can prevent matching new or modified resources. Check evidence such as policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state.
Question 789
An operator expects an Azure Policy Deny assignment to remove already-deployed noncompliant storage accounts automatically. Suppose the operator instead follows this unsafe shortcut: Assume Audit automatically prevents any matching ARM deployment. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that a successful remediation test was the original reason the plan was disabled.
- The resulting security weakness is that documenting an approved policy assignment is the cause of its earlier absence.
- The resulting security weakness is that maintaining the required incident log is itself the unauthorized API request.
- The resulting security weakness is that using only Audit does not block new deployments and Deny does not automatically delete existing resources.
Explanation
Correct Answer
D:The suitable control is: Select and assign a policy effect appropriate to prevention or assessment and test new and existing resources. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Azure Policy audit versus deny effects weakness after the shortcut. A successful remediation test was the original reason the plan was disabled.
B:Documenting an approved policy assignment is the cause of its earlier absence.
C:This does not explain the real Azure Policy audit versus deny effects weakness after the shortcut. Maintaining the required incident log is itself the unauthorized API request.
Question 790
An operator expects an Azure Policy Deny assignment to remove already-deployed noncompliant storage accounts automatically. A review identifies this consequence: Using only Audit does not block new deployments and Deny does not automatically delete existing resources. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to deploy the intended preventive effect and address existing noncompliance through separately approved remediation.
- The controlled remediation is to treat Deny as a universal automatic cleanup of all existing noncompliant resources.
- The controlled remediation is to assume Audit automatically prevents any matching ARM deployment.
- The controlled remediation is to use a management group Reader grant to deny resource creation by all other principals.
Explanation
Correct Answer
A:Test using these records: Policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Treat Deny as a universal automatic cleanup of all existing noncompliant resources. This would not reliably restore the intended security boundary. Using only Audit does not block new deployments and Deny does not automatically delete existing resources. The appropriate controlled recovery is: Deploy the intended preventive effect and address existing noncompliance through separately approved remediation.
C:Assume Audit automatically prevents any matching ARM deployment. This would not reliably restore the intended security boundary. Using only Audit does not block new deployments and Deny does not automatically delete existing resources. The appropriate controlled recovery is: Deploy the intended preventive effect and address existing noncompliance through separately approved remediation.
D:Use a management group Reader grant to deny resource creation by all other principals. This would not reliably restore the intended security boundary. Using only Audit does not block new deployments and Deny does not automatically delete existing resources. The appropriate controlled recovery is: Deploy the intended preventive effect and address existing noncompliance through separately approved remediation.
